CVE-2026-116336: PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions

Published Nov 12, 2026

Updated

Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which PostgreSQL versions need remediation?

Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Upgrade to the applicable fixed release or later.

What level of access does an attacker need?

The attacker must be able to create the relevant database object, including an index expression that can issue DROP INDEX. The issue can then lead to arbitrary code execution as the operating system user running PostgreSQL.

Is this exploitable remotely without authentication?

No. The vector is network-accessible, but exploitation requires low-level privileges, as reflected by PR:L; it is not described as unauthenticated.